Welcome to Splunk Answers, a Q&A forum for users to find answers to questions about deploying, managing, and using Splunk products. Contributors of all backgrounds and levels of expertise come here to find solutions to their issues, and to help other users in the Splunk community with their own questions.

This quick tutorial will help you get started with key features to help you find the answers you need. You will receive 10 karma points upon successful completion!

Refine your search:

Capturing SNMP data from local SNMP WMI Provider

0

How can I capture WMI data from the local machine in Splunk? The program I am working on has a preexisting tool that used WMI to report data from SNMP devices (UPS, environment monitors, etc) to our NetIQ instance rather than writing it out to a flat file to be read in.

We don't have the budget to modify that tool as part of migrating to Splunk and all the information I've found for monitoring WMI data in Splunk assumes it is from a different machine and correspondingly requires a domain account instead of being able to run as the local service user.

How can I capture data from the local machine using WMI (preferably continuing to install Splunk as the local user)?

ADDITIONAL DETAILS: I have confirmed that the Windows SNMP Service and SNMP WMI Provider are installed on the same machine that the Splunk indexer is running on. Since they're on the same machine, no network traffic should be required.

For that part, still in the planning stages. All our other logs we're capturing are either from Windows events or log files so I have them figured out. It's just the SNMP captures I still need to figure out.